Classification of UDP traffic from P2P applications

摘要

In this paper, we select several prevalent Peer-to-peer (P2P) network TV as research objects, and analyze their differences in port usage and packet size distribution thoroughly, based on their traffic from local captured files. By observing and summarizing the above characteristics, we discover that (i) a network TV application employs only one port to generate most of UDP traffic in one communication period, and (ii) the UDP packet sizes in various network TVs differ significantly. Thus, a methodology that can classify P2P application's UDP traffic accurately and effectively is proposed. Through identifying and verifying the PPStream (PPS) application traffic which is called trace data collected from the backbone channel of CERNET (China Education and Research NETwork) border Jiangsu Province, we are able to classify more than 96% of the traffic with accuracy of over 97%. At the end of the paper, by marking the trace data through our methodology, we list the results with the term of traffic proportion about the selected P2P applications.